[FIXED] Building Whonix from source code is NOT safe at the moment due to APT vulnerability DSA 4371-1

[Patrick]

Update:
Building is safe again as per git tag 14.0.1.3.1-developers-only.

This news is primarily to inform developers and everyone who builds Whonix from source code. If that doesn’t mean anything to you, this news can be safely ignored.

---

• This news is about Non-Qubes-Whonix only.
• Qubes(-Whonix) is build security up to Qubes (and [work in progress](Apt RCE announced. New Whonix images needed. Whonix build NOT safe at the moment.)).

Building Whonix from source code is NOT safe at the moment due to APT vulnerability.

APT vulnerability DSA 4371-1:
~~ https://lists.debian.org/debian-security-announce/2019/msg00010.html~~

APT vulnerability security advisory by Whonix:
~~ https://www.whonix.org/wiki/Operating_System_Software_and_Updates#apt_security_update_-_DSA_4371-1~~

APT vulnerability security advisory by Whonix forum discussion:
special instructions required to securely update because of apt security update [DSA 4371-1]

Please wait until this forum post is updated and/or until a news posting the security fix has been posted.

~~Context:
https://www.whonix.org/wiki/Dev/Build_Documentation

Patches welcome.
https://www.whonix.org/wiki/FAQ#Patches_are_Welcome

Development discussion:
Apt RCE announced. New Whonix images needed. Whonix build NOT safe at the moment.

[TNT_BOM_BOM]

will there be an images of whonix fixing up the vulnerability before update/upgrade? (like the same what happened in previous apt vulnerability)

[Patrick]

Yes.

Apt RCE announced. New Whonix images needed. Whonix build NOT safe at the moment.

Whonix build NOT safe at the moment. Build happens in chroot but these aren’t safe against breakout. So building now could compromise a build machine. Applies to Non-Qubes-Whonix only. Qubes(-Whonix) build attempts to fix this. Technical background: Misery of Debian package repositories: Debian package repository: contains vulnerable apt version. security.debian.org Debian security fixes package repository: contains fixed apt version. debootstrap is a popular Debian tool. Also used by…

[panic24hrs]

Kindly explain what it means for the current OVAs as in https://www.whonix.org/wiki/VirtualBox/XFCE

I want to download and start using 14.0.0.9.9 - do you recommend waiting for another point release?

[Patrick]

Update as per https://www.whonix.org/wiki/Operating_System_Software_and_Updates#apt_security_update_-_DSA_4371-1 or wait.

[Patrick]

Update:

Building Whonix from source code is safe again (APT vulnerability DSA 4371-1)

This news is primarily to inform developers and everyone who builds Whonix from source code. If that doesn’t mean anything to you, this news can be safely ignored. Building Non-Qubes-Whonix from source code is safe again as per git tag 14.0.1.3.1-developers-only. Qubes-Whonix fixed this independently. This is only about builds of Whonix. Resulting images are untested at the time of writing. Users should wait for testers-only or stable release. Context: [FIXED] Building Whonix from source …

[Patrick]

git tag:

14.0.1.3.8-testers-only

Whonix VirtualBox 14.0.1.3.8 - Point Release - Testers Wanted!

Testers Wanted! This is a release candidate for a point release. Debian APT remote code execution vulnerability DSA 4371-1 is fixed in this version. Therefore, special instructions for upgrading are not required. The usual standard (“everyday”) upgrading instructions should be applied. Download the Testers-Only version of Whonix for VirtualBox: